2026-08-03_29dbd2770b1eee25f822e8f2f2b7127e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-08-03_29dbd2770b1eee25f822e8f2f2b7127e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 1.2MB
Sample260803-ddhbvabb97
SHA256 aa72eb1a1fc928914146b8424049240e8d6093ff01a9fcabb6ca8846375e8e2b
MD5 29dbd2770b1eee25f822e8f2f2b7127e
SHA1 e44216c328b1fe741c14265f0fa7d067aa518be7
SHA512 80c6bafc555bd6b570086e0479b0e78a9cd5d540dd4304a0996d6950045054088c055d6f7e77a177ff325eec823db7f76d8b9064445f1d8456db52ff82c8a648
SSDEEP 24576:y2LXP9w+G9GGyZEmlU9Xozsr8zbhN6GwXOGIh4:yMGErmmIXozsr8zlLwJIh
TLSH
T15A459D65AA040DBCEAF1B638DBDD536193A13D95037744CF23D03F8A3A37992AE7A111
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_29dbd2770b1eee25f822e8f2f2b7127e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-03_29dbd2770b1eee25f822e8f2f2b7127e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.2MB

2026-08-03_29dbd2770b1eee25f822e8f2f2b7127e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 84a549ce870e1f425823d22d601183b2
SHA256 aa72eb1a1fc928914146b8424049240e8d6093ff01a9fcabb6ca8846375e8e2b
MD5 29dbd2770b1eee25f822e8f2f2b7127e
SHA1 e44216c328b1fe741c14265f0fa7d067aa518be7
SHA512 80c6bafc555bd6b570086e0479b0e78a9cd5d540dd4304a0996d6950045054088c055d6f7e77a177ff325eec823db7f76d8b9064445f1d8456db52ff82c8a648
SSDEEP 24576:y2LXP9w+G9GGyZEmlU9Xozsr8zbhN6GwXOGIh4:yMGErmmIXozsr8zlLwJIh
TLSH
T15A459D65AA040DBCEAF1B638DBDD536193A13D95037744CF23D03F8A3A37992AE7A111
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

95984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\steam_monitor\win64\Release\steam_monitor.pdb

kernel32

GetProcAddress GetModuleHandleA OutputDebugStringA IsDebuggerPresent GetCurrentProcess TerminateProcess GetLastError EnterCriticalSection LeaveCriticalSection GetCommandLineA HeapAlloc HeapFree GetProcessHeap HeapSetInformation HeapLock HeapUnlock HeapWalk HeapQueryInformation GlobalMemoryStatusEx VirtualAlloc VirtualFree QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime SetUnhandledExceptionFilter FreeLibrary GetModuleFileNameW LoadLibraryExA LoadLibraryExW LoadLibraryA MultiByteToWideChar WideCharToMultiByte DeleteCriticalSection CloseHandle RaiseException SetLastError InitializeCriticalSectionAndSpinCount TryEnterCriticalSection SetEvent ResetEvent WaitForSingleObject CreateEventA Sleep GetCurrentProcessId GetCurrentThreadId OpenThread GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree OpenProcess InitializeCriticalSection RtlCaptureStackBackTrace GetCommandLineW VirtualProtect GetModuleFileNameA LocalAlloc LocalFree GlobalAlloc GlobalUnlock GlobalLock DebugBreak GetProcessHeaps SetEnvironmentVariableW CreateFileW DeleteFileW CreateProcessW MoveFileExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx HeapSize HeapValidate GetStdHandle WriteFile ExitProcess GetModuleHandleExW IsProcessorFeaturePresent FlushFileBuffers GetConsoleOutputCP GetConsoleMode RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetFileType GetFileSizeEx SetFilePointerEx HeapReAlloc GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW ReadFile ReadConsoleW WriteConsoleW SetEndOfFile RtlUnwind

psapi

GetProcessMemoryInfo

user32

SetDlgItemTextA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetDlgItemInt GetWindowRect MessageBoxA GetDesktopWindow EnumWindows GetWindowThreadProcessId GetDlgItemInt GetDlgItem EndDialog DialogBoxParamA IsWindowVisible SetWindowPos GetWindowTextLengthA wsprintfA

shell32

CommandLineToArgvW

Name

.text

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_29dbd2770b1eee25f822e8f2f2b7127e_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc

kernel32

psapi

user32

shell32

generic